Security hardening: timing attacks, LDAP injection, auth guards, permissions - #65

Open

minh-tg wants to merge 13 commits into

minh-tg:pr/security-hardening

Commits on Jun 27, 2026

test: mock NVD API calls, add nvd_integration marker
minh-tg
committed
c82483e
fix: guard Docker Login and add hybrid fallback for DB/SALT
minh-tg
committed
c5c6680
security: fix timing attack on API key verification (C1)
minh-tg
committed
59b4dba
security: prevent LDAP injection via username escaping (C2)
minh-tg
committed
79e9fd7
security: guard dev auth with IS_DEV check (C3)
minh-tg
committed
03b1ec3
security: add permission check to DeleteProjectAPI (H1)
minh-tg
committed
2314791
security: validate CVE ID format and add request timeouts (H2)
minh-tg
committed
030d4ab
security: whitelist templates in HtmlView (H5)
minh-tg
committed
835b2a2
security: improve Docker security configuration (L1/L2/L3)
minh-tg
committed
25b1a4c
security: rate limiting, dev creds, CORS, HTTPS settings (H3/H4/M2/M3)
minh-tg
committed
b41e3e9
fix: update test assertions from 406 to 200 (content negotiation now works)
minh-tg
committed
da0ae14
Revert "fix: update test assertions from 406 to 200 (content negotiation now works)"
minh-tg
committed
09f8279
fix: make dev admin a superuser so permission checks pass
minh-tg
committed
c3418d8